VelocIQ · Privacy Notice
VelocIQ LLC · Houston, Texas
Privacy Notice
Effective Date: July 13, 2026
Version 1.1
This Privacy Notice describes how VelocIQ LLC collects, uses, stores, and protects information in connection with the VelocIQ platform. It is addressed to the business entities and individuals who use or are subject to the VelocIQ platform.
VelocIQ LLC is a B2B organizational intelligence company based in Houston, Texas. VelocIQ is not a data broker. It is not a consumer product. VelocIQ processes organizational communications data on behalf of the businesses that contract for its services to provide, secure, support, calibrate, and improve the VelocIQ platform and to generate intelligence output for those businesses' internal use.
For questions about this Notice or VelocIQ's data practices, contact us at admin@velociq.ai.
VelocIQ processes the following categories of data from the Microsoft 365 environment of its client organizations, pursuant to explicit written authorization from the client:
— Email messages: sender, recipients, subject, body, timestamps, attachments and attachment content
— Microsoft Teams messages: message content, sender, recipients, timestamps
— Calendar data: meeting titles, participants, dates, times, and meeting metadata
— Contact data: names, email addresses, and organizational relationships derived from the above
VelocIQ does not access personal consumer accounts. All access is limited to the client's business Microsoft 365 tenant and the specific data categories authorized in the client's data access agreement.
VelocIQ collects information necessary to operate the platform, including: authorized user email addresses, login events, feature usage patterns, and error logs. This data is used solely for platform operation, security, and improvement.
VelocIQ does not intentionally solicit or collect payment card numbers (handled by payment processors); health or medical information; government identification numbers; or data from personal devices or personal email accounts not part of the client's Microsoft 365 tenant. However, because VelocIQ processes general business communications, these categories of information may be incidentally present in client-authorized data. Clients must not use the Platform to process regulated data — including protected health information subject to HIPAA, payment cardholder data subject to PCI-DSS, or other data requiring a separate written agreement — unless separately authorized in writing by VelocIQ. VelocIQ does not knowingly process data from individuals under 18 years of age in any capacity.
VelocIQ uses Communications Data solely for the following purposes:
— Ingesting, normalizing, and storing communications data in the VelocIQ multi-tenant database on the client's behalf
— Running signal detection, relationship health scoring, and briefing generation algorithms against the client's data
— Generating intelligence outputs — briefings, scores, signals — for display to the client's authorized users
— Calibrating signal detection thresholds and scoring parameters based on client feedback
— Operating, maintaining, securing, and improving the platform
— Complying with applicable law
VelocIQ uses large language model APIs (currently Anthropic Claude) to extract structured intelligence from communications data. Communications data is transmitted to the Anthropic API for this purpose. Under VelocIQ's current commercial API arrangement, Anthropic generally deletes API inputs and outputs within 30 days. Certain API features, model configurations, legal requirements, or content flagged for usage-policy enforcement may be subject to different or longer retention periods. Anthropic does not use VelocIQ client inputs or outputs to train its general-purpose models by default. Clients with requirements for zero-data-retention AI processing should contact VelocIQ at admin@velociq.ai before activating the platform.
VelocIQ may use aggregate and anonymized patterns derived from client data for internal benchmarking, signal calibration, and platform improvement. Aggregate data cannot be used to identify any individual or any specific client organization.
VelocIQ does not sell, rent, or otherwise transfer client Communications Data or identifiable intelligence outputs to any third party for commercial purposes. VelocIQ does not sell Communications Data or identifiable Intelligence Output, share it for targeted advertising or cross-context behavioral purposes, or disclose it except to approved service providers acting on VelocIQ's behalf, as directed by the client, as necessary to provide or secure the services, in connection with a permitted corporate transaction, or as required by law.
Communications Data is stored in Microsoft Azure infrastructure located in the United States (West US 3 region). Raw communications data is stored in Azure Blob Storage in a dedicated per-tenant container. Extracted intelligence signals and scores are stored in Azure PostgreSQL with logical per-tenant isolation enforced at the application layer.
VelocIQ maintains the following minimum security controls:
— Raw communications data stored in Azure Blob Storage in a dedicated per-tenant container with AES-256 encryption at rest; extracted intelligence signals and scores stored in Azure PostgreSQL with logical per-tenant isolation enforced at the application layer
— TLS 1.2 or higher encryption for all data in transit
— OAuth 2.0 authentication for Microsoft 365 access — VelocIQ does not receive or store customer Microsoft 365 passwords; OAuth access and refresh tokens are encrypted and stored exclusively in Azure Key Vault
— Access limited to authorized VelocIQ personnel and contractors on a need-to-know basis
— Multi-factor authentication required for all personnel with system access
VelocIQ contractors who require access to client data are subject to written non-disclosure and data handling agreements that impose confidentiality, security, and use restrictions at least as protective as those in this Notice and in the client's service agreement. Contractors are granted the minimum access necessary for the specific task authorized in writing.
In the event of a security incident involving, or reasonably suspected to involve, client Communications Data, VelocIQ will notify affected clients in writing within seventy-two (72) hours of becoming aware of the incident, or sooner where practicable. Initial notice may be based on incomplete information and will be supplemented as the investigation proceeds. Notification will include the known nature and scope of the incident, the data and individuals affected to the extent known, containment measures taken, and a commitment to provide ongoing updates. VelocIQ will cooperate with the client's investigation and response efforts and will not issue public disclosures regarding a client-specific incident without prior consultation with the affected client, except where required by law.
VelocIQ retains Communications Data and Intelligence Output for the duration of the client's service agreement plus a thirty (30) day period following termination to allow for transition and export. After that period, identifiable data is deleted unless the client has made a written request for earlier deletion.
A client may request deletion of its identifiable Communications Data and Intelligence Output at any time by written notice to admin@velociq.ai. VelocIQ will complete deletion within thirty (30) days and will provide written confirmation. Aggregate and anonymized patterns derived across client data — from which no individual or specific client organization can be identified — may be retained for internal benchmarking and platform improvement purposes only.
Data stored in routine system backups is deleted through VelocIQ's ordinary backup-rotation process and will be deleted or rendered inaccessible no later than fourteen (14) days after deletion from active blob storage and seven (7) days after deletion from the production database.
The VelocIQ platform processes internal communications of client organizations, which may include messages and emails sent or received by the client's employees. VelocIQ provides the intelligence tooling. The client organization is the employer and is solely responsible for:
— Ensuring its use of the platform complies with applicable federal, state, and local workplace monitoring and electronic communications laws
— Providing employees with adequate notice of communications monitoring
— Obtaining any required employee consents
Employee data processed by VelocIQ is used solely to generate intelligence for the employer-client. VelocIQ does not provide employee data to any person other than the client's authorized users. Individual employee intelligence is not sold, shared, or disclosed to any third party.
VelocIQ relies on the following categories of third-party service providers to deliver the platform:
— Microsoft Azure: cloud infrastructure, storage, and Key Vault credential management
— Anthropic: large language model API for signal extraction and intelligence generation
— Microsoft Graph API: Microsoft 365 data access
Each provider is subject to its own privacy terms. VelocIQ selects providers that maintain appropriate security and confidentiality standards. VelocIQ does not share client data with advertising networks, data brokers, or analytics services.
As a client organization, you have the right to: request a description of the Communications Data categories VelocIQ holds for your tenant; request deletion of your data pursuant to Section 5.2; revoke VelocIQ's access to your Microsoft 365 tenant at any time through the Microsoft Entra admin center; and receive written confirmation of deletion.
Employees or other individuals whose data may be processed as part of a client organization's Communications Data should direct rights requests to their employer (the VelocIQ client). VelocIQ will cooperate with clients in responding to such requests consistent with the client's data access agreement.
If VelocIQ is required by valid legal process to disclose client data, VelocIQ will provide the client with prompt written notice before any disclosure to the extent permitted by law, and will cooperate with the client's efforts to seek a protective order or other relief.
The VelocIQ web application uses session authentication cookies necessary for platform operation. VelocIQ does not use advertising cookies, tracking pixels, or third-party analytics services on authenticated platform pages. The VelocIQ marketing website (velociq.ai) may use limited analytics to measure traffic and improve the site. VelocIQ does not sell website visitor data.
VelocIQ may update this Privacy Notice to reflect changes in its data practices, applicable law, or platform functionality. Material changes will be communicated to active clients by email at least thirty (30) days before the effective date. The current version of this Notice is always available at velociq.ai and upon request from admin@velociq.ai.
For questions about this Privacy Notice or VelocIQ's data practices:
VelocIQ LLC
Houston, Texas
admin@velociq.ai
We will respond to written inquiries within ten (10) business days.
VelocIQ LLC · admin@velociq.ai